Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

looplj/axonhub

              unstable @ edc1d26
            

Fixes

CVEs

HIGH

Peak severity

45.9%

Coverage

Highlights

Auth Bypass: 25 prior fixes. Scrutinize any change in this area.

internal/server/gql/dashboard.resolvers.go: most-fixed (3 issues). Treat as high-risk during review.

21 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Authentication and authorization mechanisms frequently suffer from structural bypasses, including incorrect handling of project status checks, session hijacking in WebSocket layers, and missing explicit default authentication rules. Strict enforcement of 'allow_no_auth' configurations and robust client-keying are essential.

Auth Bypass: Tenant boundaries and permission rules were bypassed due to incomplete soft-delete handling in relational database queries and relying on client-side filter parameters rather than strict server-side project validations. This can allow deactivated users to retain access.

Server-Side Request Forgery: Insecure hostname verification in provider quota URL checks allows attackers to bypass restrictions using weak domain validation mechanisms like suffix-matching. Similarly, the model fetcher is prone to credential disclosure via SSRF when handling different base URLs.